What Is a Release of Information?
A Release of Information (ROI) — formally an authorization for use and disclosure of protected health information under HIPAA (45 CFR 164.508) — is a written document signed by the client that permits a mental health provider to share specific clinical information with a named third party. Without a valid authorization, HIPAA prohibits disclosing PHI except where the Privacy Rule permits or requires it, such as for treatment, payment, and health care operations, or when required by law.
In mental health practice, the ROI is one of the most frequently used compliance documents. Clients may need records sent to an attorney, an employer, a school, a disability evaluator, or a family member. An ROI that is missing required elements, expired, or revoked is not valid, and disclosing under it can lead to HIPAA violations, malpractice claims, and licensing board complaints.
The ROI is also the client's main way to control who sees their mental health information: what is shared, with whom, and for how long.
ROI, Authorization, Consent: Which Term Means What?
| Term | What it means | Rules |
|---|---|---|
| Release of information (ROI) | Everyday clinic name for the form | Whatever the name, a HIPAA disclosure form must meet 45 CFR 164.508 |
| HIPAA authorization | The Privacy Rule's term for the client's written permission to use or disclose PHI | 45 CFR 164.508(c) core elements and required statements |
| Psychotherapy-notes authorization | An authorization for psychotherapy notes | Can only be combined with another psychotherapy-notes authorization (164.508(b)(3)(ii)) |
| Part 2 consent | Written consent for substance use disorder records from a federally assisted program | 42 CFR 2.31 elements; notice in 2.32 must accompany each disclosure |
| Consent to treatment | Agreement to receive services | Not a disclosure authorization; see informed consent |
When You Need It
- When a client asks you to communicate with their attorney, employer, or school
- When you will share information with family members beyond what HIPAA's family-involvement rule (45 CFR 164.510(b)) and your state law allow. That rule permits sharing only information directly relevant to the person's involvement in the client's care or payment, and written authorization is the safer practice when in doubt.
- When a disability or insurance company requests clinical information beyond routine billing
- When a client wants you to provide information for a legal proceeding and there is no court order
- When records are psychotherapy notes, which need their own authorization even for another treating provider
- When state law or your organization's policy requires written permission for a disclosure HIPAA would otherwise allow, such as some sharing with another provider
You do not need an ROI for a client's own request to see or copy their records. That is the HIPAA right of access (45 CFR 164.524), which has its own rules and timelines.
What a Valid ROI Must Contain
Under 45 CFR 164.508(c), an authorization must have six core elements, three required statements, and plain language.
Core elements (164.508(c)(1)):
- A description of the information to be used or disclosed that identifies it "in a specific and meaningful fashion"
- Who may make the disclosure, identified by name or other specific means
- Who may receive it, identified the same way
- A description of each purpose. "At the request of the individual" is enough when the client starts the request and does not state a purpose.
- An expiration date or an expiration event that relates to the client or the purpose
- The client's signature and date. If a personal representative signs, a description of their authority to act for the client.
Required statements (164.508(c)(2)):
- The right to revoke in writing, with the exceptions and how to revoke (or a reference to your Notice of Privacy Practices if it covers this)
- Whether treatment, payment, enrollment, or eligibility can be conditioned on signing. For most therapy disclosures you cannot condition them, and the form must say so.
- That information disclosed may be redisclosed by the recipient and may no longer be protected by HIPAA
Also required: plain language (164.508(c)(3)), and a copy of the signed form for the client when you are the one asking for the authorization (164.508(c)(4)).
An authorization is not valid if the expiration has passed, a required element is not filled in, you know it was revoked, it breaks the rules on combining or conditioning authorizations, or you know material information in it is false (164.508(b)(2)).
Key Components / What to Include
1. Client Identification
Full legal name, date of birth, and any other identifying information needed to find the correct record. A client ID or record number helps in larger practices.
2. Person or Entity Authorized to Disclose
Your name, credentials, practice name, address, and contact information.
3. Person or Entity Authorized to Receive
The specific name, title, organization, address, and contact information of the recipient. Avoid vague designations like "my attorney" or "my doctor" without identifying information.
4. Description of Information to Be Disclosed
Be specific. Rather than "all records," name the type of information (intake assessment, treatment summary, diagnosis, progress notes, testing results) and the date range. HIPAA requires a "specific and meaningful" description. Psychotherapy notes need a separate form.
5. Purpose of the Disclosure
State why the information is being released (continuity of care, disability evaluation, legal proceeding). "At the request of the individual" is enough when the client initiates the request and declines to state a purpose.
6. Expiration Date or Event
Every valid authorization needs an expiration date or an expiration event (for example, "when my disability claim is decided"). See "How Long Is a Signed ROI Valid?" below.
7. Right to Revoke
State that the client may revoke the authorization in writing at any time, how to do it, and that revocation does not affect disclosures already made in reliance on it.
8. Ability to Condition Treatment
State that you will not condition treatment, payment, enrollment, or eligibility on the client signing. The exception is care provided solely to create information for a third party, such as a fitness-for-duty evaluation: there you may condition the service on the authorization, and the form must state the consequences of refusing (164.508(b)(4)(iii), (c)(2)(ii)(B)).
9. Potential for Re-disclosure
State that information disclosed may be redisclosed by the recipient and may no longer be protected by HIPAA. For Part 2 records, see the substance use section below.
10. Signature and Date
The client's signature, or that of a personal representative, and the date. If a representative signs, describe their authority (parent of a minor, legal guardian, health care power of attorney).
How Long Is a Signed ROI Valid?
HIPAA does not set a fixed lifetime. It requires every authorization to name an expiration date or an expiration event that relates to the client or the purpose (164.508(c)(1)(v)), and the authorization stops being valid when:
- the expiration date has passed, or you know the expiration event has occurred;
- you know it has been revoked; or
- you learn it was defective in another way (164.508(b)(2)).
The words "none" or "end of the research study" are only allowed for research authorizations. For a clinical ROI, use a real date or event.
Choosing an expiration. Tie it to the purpose: a fixed date for ongoing coordination, or an event such as "completion of the custody evaluation" for a one-off disclosure. If you use a default on your form, as the template below does, set it deliberately.
State law and Part 2. Some states set their own rules for how long a mental health authorization lasts or what it must say, and those can be stricter than HIPAA. Part 2 consents also need an expiration date or event, though for a treatment, payment, and operations consent "end of the treatment" or "none" is enough (42 CFR 2.31(a)(7)). Check your state's rules before setting defaults.
How to Revoke a Release of Information
- The client revokes in writing. HIPAA requires revocation to be in writing (164.508(b)(5)). A short signed note that identifies the authorization and clearly revokes it is enough; do not keep disclosing just because the client did not use your preferred form. If a client revokes verbally, stop and ask them to put it in writing; record what they said.
- Record it. Date-stamp the revocation, file it with the original authorization, and flag the chart.
- Stop disclosures. An authorization you know has been revoked is not valid (164.508(b)(2)(iii)).
- Prior disclosures stand. Revocation does not reach actions you already took in reliance on the authorization (164.508(b)(5)(i)). There is a second exception for authorizations obtained as a condition of getting insurance coverage (164.508(b)(5)(ii)), which rarely applies in a therapy practice.
ROI vs Power of Attorney
| Release of information | Power of attorney (health care) | |
|---|---|---|
| What it does | Permits specific disclosures of the client's information | Lets an agent act for the client, as defined in the document and state law |
| Who signs | The client or their personal representative | The client (the principal) appoints the agent |
| Scope | Named information, recipient, purpose, and expiration | Set by the document's terms and state law |
| HIPAA effect | The legal basis for the disclosures it describes | If it gives authority to make health care decisions, HIPAA treats the agent as the client's personal representative for the relevant information (45 CFR 164.502(g)(2)) |
A personal representative can sign an ROI for the client, and the form must describe their authority (164.508(c)(1)(vi)). A power of attorney limited to financial matters may not give health care decision authority; check the document and state law, and ask a healthcare attorney when unsure. Separate HIPAA rules govern parents of minors and personal representatives in abuse or safety situations (164.502(g)(3) and (g)(5)).
Substance Use Disorder Records: 42 CFR Part 2
42 CFR Part 2 protects records of federally assisted substance use disorder programs ("Part 2 programs") and limits what recipients can do with them. HHS revised Part 2 in a final rule published February 16, 2024 to align it more closely with HIPAA. The rule took effect April 16, 2024, with compliance required by February 16, 2026. Under the current rule:
- Consent elements: a Part 2 consent must include the items in 42 CFR 2.31(a), including the patient's name, the discloser and recipients, a specific description of the information, each purpose, the right to revoke and how, an expiration date or event, signature, and date.
- Single consent for TPO: a patient may give one consent for all future uses and disclosures for treatment, payment, and health care operations. That consent must state the potential for redisclosure and the consequences of refusing to sign (2.31(a)(10)).
- Notice with each disclosure: each disclosure made with consent must be accompanied by one of the notice statements in 42 CFR 2.32, plus a copy of the consent or a clear explanation of its scope.
- Legal proceedings: consent to use records in civil, criminal, administrative, or legislative proceedings cannot be combined with consent for any other purpose (2.31(d)). A subpoena alone does not authorize disclosure of Part 2 records; it must be paired with that consent or with a court order issued under 42 CFR Part 2, subpart E (42 CFR 2.61).
- SUD counseling notes: like psychotherapy notes, they need their own consent, which may only be combined with another consent for SUD counseling notes (2.31(b)).
If you are not sure whether your practice or a record you hold is covered by Part 2, get a compliance or legal opinion before you rely on a HIPAA-only form.
Release of Information (Authorization for Disclosure of PHI)
AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Client Information: Name: _______________________________________________ Date of Birth: ________________________________________ Client ID/Record Number (if applicable): __________________
I authorize the following party to DISCLOSE information: Name: [Clinician Name], [Credentials] Practice: [Practice Name] Address: [Practice Address] Phone: [Phone Number] Fax: [Fax Number]
I authorize the following party to RECEIVE information: Name: _______________________________________________ Title/Organization: _____________________________________ Address: _____________________________________________ Phone: _________________ Fax: _________________________
Information to be disclosed (check all that apply):
- Intake/diagnostic assessment
- Treatment summary/discharge summary
- Progress notes (dates: __________ to __________)
- Diagnosis and treatment plan
- Psychological/neuropsychological testing results
- Medication records
- Substance use disorder treatment records (if these come from a federally assisted program, 42 CFR Part 2 applies and this form must also meet Part 2 consent requirements)
- Other (specify): ___________________________________
Note: Psychotherapy notes (as defined by HIPAA) are NOT included in this authorization. Releasing them requires a separate authorization form that covers psychotherapy notes only.
Purpose of disclosure:
- Continuity of care / coordination of treatment
- At the request of the client
- Legal proceeding
- Disability/fitness evaluation
- Insurance/benefits determination
- Other (specify): ___________________________________
Expiration: This authorization expires on ________________ (date) or upon the following event: ________________. If neither a date nor an event is filled in, this authorization expires 180 days from the date of signature. [Practice default: set your own, and check state law for any maximum.]
I understand that:
-
I may revoke this authorization at any time by providing written notice to the disclosing party named above. Revocation will not affect information already disclosed in reliance on this authorization.
-
My payment, enrollment, or eligibility for benefits will not be conditioned on whether I sign this authorization. My treatment will not be conditioned on it either, except that a service provided solely to create information for the third party named above (for example, a requested fitness-for-duty or disability evaluation) may require this authorization. If that applies, the consequence of not signing is: ________.
-
Information disclosed pursuant to this authorization may potentially be re-disclosed by the recipient and may no longer be protected by federal privacy regulations.
-
I will receive a copy of this signed authorization.
-
I may refuse to sign this authorization and may request to discuss the implications with my therapist before signing.
Signature: ____________________________________________ Printed Name: _________________________________________ Date: ________________________________________________
If signed by personal representative: Representative Name: ____________________________________ Relationship to Client: ____________________________________ Authority (e.g., parent, guardian, POA): ______________________
For provider use: Date authorization received: _______________________________ Date information disclosed: ________________________________ Information disclosed to: __________________________________ Method of disclosure: [ ] Mail [ ] Fax [ ] Secure email [ ] Hand-delivered [ ] Secure portal Staff member processing disclosure: _________________________
This is a sample for educational purposes only — not real patient data.
How to Implement It
Step 1: Stock blank forms. Keep ROI forms in your intake packet, in the office, and on your client portal. Keep a separate psychotherapy-notes authorization form if you keep psychotherapy notes.
Step 2: Review every completed ROI before acting on it. Check every core element and required statement: specific information, discloser, recipient, purpose, expiration, signature and date, revocation statement, conditioning statement, and redisclosure statement. If anything is missing, ask for a corrected form.
Step 3: Disclose only what the form covers. HIPAA's minimum necessary standard does not apply to disclosures made under an authorization (45 CFR 164.502(b)(2)(iii)), so the form's scope is the limit. That is why the description matters: if the client only wants a treatment summary sent, write that, not "all records." Discuss the scope with the client before they sign.
Step 4: Document every disclosure. Record the date, what was sent, to whom, how, and which authorization you relied on. Disclosures made under an authorization do not have to appear in a HIPAA accounting of disclosures (164.528(a)(1)(iv)), but your own log shows you stayed within scope. Part 2 disclosures have their own notice requirement (2.32).
Step 5: Track expiration dates. Use a log or your EHR to track ROI expiration dates and revocations. If a recipient asks for more after the authorization has expired, get a new one.
Step 6: Keep the signed authorization. File the signed ROI in the client's record. HIPAA requires you to keep it for six years from the date it was created or the date it was last in effect, whichever is later (164.508(b)(6) and 164.530(j)(2)). State law may require longer.
Common Mistakes
Using an authorization that lacks required elements. An authorization missing a core element, or not filled out completely, is not valid (164.508(b)(2)). Acting on it is an impermissible disclosure.
Releasing more information than authorized. If the client authorizes a "treatment summary," do not send progress notes, testing data, or intake assessments. When in doubt, contact the client.
Failing to verify the identity of the requesting party. Before sending records, confirm the request is legitimate. If someone calls claiming to be the client's new therapist, verify independently. Sending records to the wrong person can be a breach that you must assess and may need to report.
Accepting an expired authorization. Check the expiration date before every disclosure. An authorization that expired last month is not valid.
Adding psychotherapy notes to a general ROI. An authorization for psychotherapy notes may only be combined with another psychotherapy-notes authorization (164.508(b)(3)(ii)). A checkbox on a general release does not meet this rule. Use a separate form. See psychotherapy notes vs progress notes.
Ignoring 42 CFR Part 2 for substance use records. If you hold records from a federally assisted substance use disorder program, the consent must meet 42 CFR 2.31 and each disclosure must carry the 2.32 notice. A HIPAA-only form may be missing required Part 2 elements.